Posted
by
timothy
on Thursday May 29, 2014 @10:33AM
from the can-we-send-them-snacks? dept.

Trailrunner7 (1100399) writes "Scarcely a month after announcing the formation of a group designed to help fund open source projects, the Core Infrastructure Initiative has decided to provide the OpenSSL Project with enough money to hire two full-time developers and also will fund an audit of OpenSSL by the Open Crypto Audit Project. The CII is backed by a who's who of tech companies, including Google, Microsoft, IBM, the Linux Foundation, Facebook and Amazon, and the group added a number of new members this week, as well. Adobe, Bloomberg, HP Huawei and Salesforce.com have joined the CII and will provide financial backing. Now, the OCAP team, which includes Johns Hopkins professor and cryptographer Matthew Green, will have the money to fund an audit of OpenSSL, as well. OpenSSL took a major hit earlier this year with the revelation of the Heartbleed vulnerability, which sent the Internet into a panic, as the software runs on more than 60 percent of SSL-protected sites."

The whole security model is broken. How many CAs does your browser come with these days? Do you even know? How do you know they haven't already turned over their CA signing keys to 7 different governments?

There's no way to "fix" openssl. The entire thing is predicated on a false premise.

The system described in the article that AC's comment cites [theregister.co.uk] sounds like Namecoin. Like a full Bitcoin client, a full Namecoin client would be impractical on a mobile phone. But like Bitcoin with online wallets, Namecoin would allow third parties to run resolvers. So ideally, you could point your mobile browser to a resolver running on the VPS of someone you trust.

Yea, running your PKI infrastructure on a VPS is always the way to go, makes total sense since you're not trusting other third parties to verify things that you would trust a third party to provide you with a virtual instance to run it on...

A virtual machine runs a PC operating system of the customer's choice in a sandbox, and the server provides services from inside that sandbox through an Internet connection. Are there documented cases of VPS operators injecting malware into such a sandbox?

Are there documented cases of VPS operators injecting malware into such a sandbox?

There are indeed examples of both "break out" and "break in" attacks for various types of hypervisors, although very little evidence of anyone exploiting them. Then again, there was very little evidence of the stuff the NSA & GCHQ have been doing, so I won't assume they're not being actively exploited by someone.

Yet again, another person who can't distinguish between the technology and a particular application of that technology. What you're complaining about has nothing to do with the implementation of OpenSSL (which is what this article is about), but has to do with the application of OpenSSL. OpenSSL is doing it's job by verifying the presented certificates against the list of trusted certificate authorities that you have configured. The fact that you're trusting too many people isn't a problem with OpenSSL. (It is also not OpenSSL's concern as to how you obtained your list of trusted CAs, only that you have one.)

Yet again, another person who can't distinguish between the technology and a particular application of that technolog........

Typical engineer bullshit. We always hear how the users are to blame. Sorry; the people who design the interface which enforces this single CA stupidity are to blame for the fundamental security failures of SSL. Long before SSL was released in 1995, PGP had been released (1991!!!) with a public key based web of trust. SSL deliberately chose to ignore that. If we had been able to insist on multiple CAs per site or prioritize CAs and put more trust towards ones that were worthy and independent of governm

You're right. Nice post, you sent me on a dig around ddg. Would this be a work around? It's a browser plugin that uses GPG web of trust to check certificates peer to peer. I don't know if this plugin actually works, but I think the idea is brilliant!

The whole security model is broken. How many CAs does your browser come with these days? Do you even know? How do you know they haven't already turned over their CA signing keys to 7 different governments?

There's no way to "fix" openssl. The entire thing is predicated on a false premise.

The whole security model is broken. How many CAs does your browser come with these days? Do you even know? How do you know they haven't already turned over their CA signing keys to 7 different governments?

There's no way to "fix" openssl. The entire thing is predicated on a false premise.

OK, Moxie. We get the message. You aren't fooling anyone with the AC post, dude.

The whole security model is broken. How many CAs does your browser come with these days? Do you even know? How do you know they haven't already turned over their CA signing keys to 7 different governments?

There's no way to "fix" openssl. The entire thing is predicated on a false premise.

Nothing in OpenSSL forces you to trust any CA's you don't want to trust. Heck you don't even have to use certificates at all (TLS-PSK, TLS-SRP)

I think it is a mistake to confuse deployment failures with implementation failures with specification failure.. while there are often linkages between these things it is hard to accept that proliferation of hundreds of CA's all with overlapping global scope is anything but a deployment failure.

I'd say the horrendous state of ssl certiciate security has aspects in all three categories.

Specification failure: Certificates can only be signed by a single CA, no mechanism for multiple signatures on a cert to give a greater assurance level. No mechanism to limit a CA to a subset of the dns heirachy.Implementation failure: Major implementations include an insane default CA list*, poor handling of certificates of different trust levels (clever use of redirects can allow interception of form data for an EV

Let's just bear in mind the old saying, "A camel is a horse designed by committee."

Hiring two fulltime dedicated programmers? Seems like a good thing to me.

Submitting their work to a separate entity for auditing and verification? Sounds like a good thing to me.

As long as the various business entities involved in the auditing stick to that mandate and don't start trying to directly influence the development or design of OpenSSL, it all sounds good to me. Otherwise, we're likely to end up with CDE, the

The issue that I find, is that OpenSSL is the only Open Source Player out there.Much like File Systems, we really should have at least a few popular choices, which are interchangeable. So if there is a security problem with one we can switch to an other one.

Be careful with libressl though, the developers have been stripping out what they see as the wrong approach to portability and currently only support openbsd. There have been third party ports to other operating systems but great care is needed when making such ports as assumptions that hold on openbsd but not on other platforms may go unnoticed.

A badly done port of libressl could easilly end up significantly worse than openssl.

The issue that I find, is that OpenSSL is the only Open Source Player out there.Much like File Systems, we really should have at least a few popular choices, which are interchangeable. So if there is a security problem with one we can switch to an other one.

Several SSL implementations support the OpenSSL API including GnuTLS (open source)

NSS is also open source with shims available to help those porting from OpenSSL.

Having never used them I can't vouch for how useful they are in the real world... assume out of total ignorance they are worthless for anything but the basic SSL_* operations.

The OpenBSD folks forked OpenSSL into LibreSSL. In addition to checking security, they are doing general code cleanup, removing unnecessary/dead code. They did a talk recently about what they've accomplished: https://www.youtube.com/watch?... [youtube.com]

IMO [as a programmer of 40+ years (30+ with C)], the programming style of the code is horrible. One of the functions that produced heartbleed is called dtls1_process_heartbeat. For starters, it has one of the worst indenting schemes I've seen and seems to violate m

While I applaud the efforts and support I do hope that the work of others [opensslrampage.org] will not be ignored. The audit is great news, but I do hope the existing and new developers will look to LibreSSL for code updates, ideas and their own audit results. If we can get a nice bidirectional and completely cooperative flow between the two projects than hopefully the final result will be a highly secured, audited product that we can all use.

The problem with OpenSSL Rampage is that a major part of their approach is basically to rip everything out of OpenSSL that isn't relevant to OpenBSD, which is generally the code relevant to platforms OpenSSL supports but OpenBSD doesn't.

At first glance I agree and that is essentially what they are doing. But I do believe (can't find a link to back me up but can swear I read it somewhere) that the idea is to make LibreSSL as secure and robust as possible for OpenBSD and then start porting it to other systems, with the exceptions of course being Windows 3.1, VMS, etc. This makes sense to me; start with a known good reference implementation that uses as much of the old code as possible, just heavily cleaned up and then move on to porting (rep

And even if Theo and crew don't port it themselves I would pretty much bank on the fact that, say, someone at Debian will take the BSD code and port it to Linux - it's not as if OpenBSD will have a problem with this.

The problem with crypto is it's really easy to end up with something that works but isn't secure.

Libressl and openssl take different approaches. Openssl's appoach is to rely on the OS as little as possible. Libressl is targetted at openbsd and relies heavilly on library features provided by openbsd.

Agreed, it doesn't take much to fuck up security in an effort to make it easier. The road to hell and all that. I still cringe a little every time I have to install openssh-blacklist on Debian but in the end I think it's helpful that they are identifying the pieces that rely on specific OS and/or hardware support. By isolating these pieces for BSD they only make it easier to identify the missing bits in other OS's. Do we really need OpenSSL support for Windows 3.1? VMS? Start with the most obvious needs (Mo

Most of what they are ripping out is archaic, un-realistic, or poor implementations platforms. You could argue that hacked-support for too many platforms is part of the reason openssl is in the position its in today - if you can't do it right (or don't have the resources to), don't do it. Name a platform other than VMS, they've ripped out and that you need : )

In another comment, I posted a link to the talk that the libreSSL people gave on what they're doing. It's not really true that what they come up with won't run on other platforms. They're just removing a ton of "#if defined(OPENVMS) && (! defined(WIN32))" in favor of assuming a POSIX compliant libc. Even WinX now has that.

They're taking the "shim" approach. For example, they have two BSD-only functions: explicit_bzero [will _not_ be optimized away by the compiler--just calls bzero] and arrayall

The comments from the folks who started LibreSSL at a meeting of the Calgary Unix Users Group the other night were beyond scathing. Bob Beck's first slide shows Laura Dern in Jurassic Park, up to her elbows in stegasaurus dung, as a metaphor for what the first skim of the code felt like. It's a hopelessly overpatched mess of spaghetti code and #IFNDEF mazes that nobody can really maintain. Their fork has already tossed out tens of thousands of lines of code and started again. (Another slide shows the line from Aliens: "Nuke it from orbit. It's the only way to be sure").

If not a from-scratch rewrite, think of a home reno where you have to strip it to the frame and put up new drywalls.And this situation was allowed to grow by the current bunch that manage OpenSSL; they're only doing this at all because one of the hundreds of time-bombs in the code finally went off, and anybody who's looked it knows how many hundreds more there are. For shame.

There's a link to the slides from the libressl.org site, which is very minimal, as they say "We're too busy deleting code to make web pages".

It was just a very sobering presentation. To think we let so much depend on a pile of cruft.

By writing it in macros the code is moderately human-readable, while giving the performance benefits of actually being written in assembly. By doing it that way the compiler also has the opportunity to optimize the assembly somewhat.

I saw those slides. There were 17 levels of #ifdefs [openbsd.org] in the code. Every ifdef is a binary switch, which means 2^17 different iterations of source code.(!!!!!) That's 131072 different compiles (!!!!!!).

So, lets pretend that a config/make sequence just needs 10 minutes (unlikely, they have an oddball config script that isn't like autoconf). To hit 17 levels of ifdef, you'd need approx 910 computer-days just to do all the compiles. Do you think they tested this matrix?

Wouldn't surprise me if people commenting on hyperbole have never actually seen the source code to OpenSSL or any other open source library. They are all universally littered with ifdefs and compatibility layers from the dawn of civilization with entire suites of meta-programs (e.g. autotools) devoted to making it all work.

I have an answer to anyone who comes later to look at the code and says, "WTF??" - "Historical reasons!" This covers the seven different hacks that resulted from the hardware changing, the requirements being uprooted and new ones being grafted on, bad design decisions, and 14 years of mods to handle various idiosyncracies of different machines and OS that the dang code had to run on in those 14 years.

This is not one big mistake. It's a series of inept decisions about maintainability and auditability that finally culminated in "one big mistake". (Which, btw, probably cost on the order of at least 10M$ in wasted time.)

The problem was not so much the big mistake itself, but the culture and attitude that lead to it.

You left out the part about clever people not continuing to make the same mistakes over and over.

.
The problem with OpenSSL is not that mistakes were made.

The problem is that mistakes were made and the developers did not learn from those mistakes, did not seem to care about fixing those mistakes, and did not care about preventing similar mistakes from recurring.

The problem is that mistakes were made and the developers did not learn from those mistakes, did not seem to care about fixing those mistakes, and did not care about preventing similar mistakes from recurring.

To play Devil's advocate (or rather, advocate of the developers): if they were a properly resources software-development team, they might have been better able to pay off the technical-debt accumulating in the codebase. Hopefully this injection of resources will change things for the better. (The LibreSSL crew seem to be making good progress on the technical debt front, also.)

Humans make mistakes. Clever people make just as many mistakes. Occasionally they make huge, multiple-death causing mistakes

That's not what happened here. This was making a mistake, then instead of addressing it, building someone on top of it, and making a mistake in that, and then rather than addressing it, and so on ad infinitum.

One big mistake is not a reason to scorch and salt the earth.

Good thing that's not what is happening.

Good thing you didn't log in, you wouldn't want that kind of bullshit associated with a name.

Listen, lad. I've built this kingdom up from nothing. When I started here, all there was was swamp. All the kings said I was daft to build a castle in a swamp, but I built it all the same, just to show 'em. It sank into the swamp. So, I built a second one. That sank into the swamp. So I built a third one. That burned down, fell over, then sank into the swamp. But the fourth one stayed up.An' that's what your gonna get, lad -- the s

More than that I think this is a matter of not having the resources to deal with the codebase because OpenSSL just isn't all that sexy and man hours aren't just being thrown at that project. Much of the code that LibreSSL is removing was already tagged for removal but the man hours weren't there to take it out and throughly test the results. Now that all hell has broken loose more man hours are being thrown at it. Where were these awesome LibreSSL folks before the blowup? I'm sure plenty of people were

The big companies probably want more control over the project than LibreSSL will allow them. They've been burned once by relying on old-style Unix community dev. But it's also entirely their own fault for not funding and auditing the open source code they were building their billions on.

Seems to me LibreSSL is the way to go, but I can also see why the corporations would just use it as a side-stream for hints on what to fix. They have enough resources to rewrite openSSL from the inside rather than the the LibreSSL tear-down approach. Having both projects is really a benefit for LibreSSL as longs as it gets sufficient interest and resources.

Seems to me LibreSSL is the way to go, but I can also see why the corporations would just use it as a side-stream for hints on what to fix. They have enough resources to rewrite openSSL from the inside rather than the the LibreSSL tear-down approach.

I don't think companies really "have enough resources" to rewrite OpenSSL. The problem is that you can't just throw money at a project and have stuff happen. You need people to implement those changes. And we're still in the clutches of the software crisis. [wikipedia.org]

The problem with OpenSSL is that it is really, really bad code. [youtube.com] It's security code, which few people have the expertise to handle. It has an idiosyncratic style, which few people want to look at, it's so painful. And it is so littered with backwards comp [opensslrampage.org]

I like the idea of the "improve" strategy for OpenSSL, in addition to LibreSSL. This is the advantage of open source. I expect that each project will benefit from the perspective of the other, and as OSS projects they will hopefully cooperate to assure that the libraries interoperate. In the long run, it's not unlikely that the two will re-merge. The OpenBSD folks seem less inclined to that historically, but there are a number of projects where that has occurred - Compiz and Beryl come to mind. So thes

seriously pumping openssl full of cash at this point is like buying new deck chairs for the titanic.

It is great to see interest in improving OpenSSL yet bug fixes and deletion of compatibility layers in my opinion is in much the same category as purchase of new deck chairs.

If "we" were serious we would re-architect it from scratch to be secure by design... endeavor in which nobody is currently publically known to be engaged. I hope one or both of the teams seriously considers it. I also hope "dino dung" bravado is replaced with realization everyone is on the same side.

After seeing your note, I did a bit of searching and could not find anything significant. The only issues were those raised by Brad Knowles in 2004, which IMO were adequately addressed by the OpenNTPD folks shortly thereafter. I did not find anything else except for a bug found in Debian in 2007. The BSD team's responses noted that the purpose of OpenNTPD was not to be a complete clone of the original, but to be sufficient for most uses with security and cleanliness as the primary goals. In that context

Two developers added to an already crummy project? Ha! I'll send my money to the OpenBSD project, instead. OpenSSH and pf are just two examples of how they got the job done when outside projects fail to deliver. They'll do the same with LibreSSL, and in a year most everybody will have switched.

Take off your tinfoil hat. Stop spreading the myth that these companies don't pay taxes. If they didn't, the IRS would be all over them.

The point of comments like that is not that these companies don't pay all taxes required by law, but that current tax laws & tax treaties with foreign jurisdictions allow you to create corporate structures like the double Irish Dutch sandwich [wikipedia.org] which effectively pay no tax at all.

Support for RSA and ECC accelerators? They dealt with that. Gone.Support for symmetric crypto accelerators? They dealt with that. Gone.Vectorized C and ASM cipher implementations? They dealt with that. Gone.Portability to *anything* not OpenBSD? They dealt with that, too.

The accelerators are still there. They just use OpenBSD's unified/dev/crypto interface. In fact, for years OpenBSD's OpenSSL was the only one that did HW acceleration out-of-the-box and with no configuration except a single sysctl.conf option.

So don't bring in cryptographers. Heartbleed was a bonehead entry level programming error based on some arguably foolish decision about performance improvements. Read the code cleanup comments at libressl.org.